How do I decode a JWT online?

Paste the full token (header.payload.signature) into the Encoded JWT field. The debugger instantly shows the decoded header and payload JSON in your browser.

Does this JWT decoder upload my token?

No. Decoding and HMAC signature checks run entirely client-side. Tokens never leave your browser — treat them as credentials anyway.

Can I inspect expired JWT claims (exp / iat)?

Yes. Open the payload panel and look for exp, iat, nbf, and sub. Compare exp to the current Unix time to see whether the token is past expiry.

What about RS256 or JWE?

Asymmetric algorithms need a public key (not supported in this lightweight verifier yet). Encrypted JWE tokens need a different flow — try Base64 decode for segment inspection.

JWT debugger

JWT Debugger — decode JWT online

Q: How do I know if the secret is valid?

Enter the signing secret under Signature verification. For HS256/HS384/HS512 the tool verifies the signature and shows Signature verified or Invalid signature.

Paste a JSON Web Token to inspect the header and payload claims, then verify the signature with your secret. Runs in your browser — nothing uploaded.

Encoded JWTheader · payload · signature

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Valid JWT Web Crypto unavailable in this environment.

HeaderHS256

Payloadclaims

Signature verification base64url secret

Enter the secret used to sign the JWT (HS256 / HS384 / HS512):

Web Crypto unavailable in this environment.

How to decode a JWT online

Paste the full token (header.payload.signature) into Encoded JWT — a sample is preloaded.
Read the color-matched Header and Payload panels as you edit the token.
Enter the signing secret to see whether the signature is valid.

What the colors mean

Header — algorithm and type (alg, typ).
Payload — claims like sub, iat, exp.
Signature — HMAC integrity check against your secret.

JWT debugger FAQ

How do I know if the secret is valid? Enter it under Signature verification. For HS256/HS384/HS512 you will see Signature verified or Invalid signature.

Does editing the payload change the encoded JWT? Yes. Header and payload edits re-encode those segments; the previous signature will usually become invalid until you re-sign elsewhere.

Does this upload my token? No. Everything runs client-side.